server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Docker's embedded DNS. Without re-resolving at request time, nginx caches the
    # api container's IP from startup and keeps returning 502 ("no live upstreams")
    # after the api container restarts with a new IP.
    resolver 127.0.0.11 valid=10s ipv6=off;

    # /api/uploads/* must win over /api/ so files are not handled as Nest JSON
    # routes. ^~ also beats the static-file regex below (which would otherwise
    # try to serve /uploads/*.png from this nginx html root and 404).
    location ^~ /api/uploads/ {
        set $api_upstream http://hedenagold-api:3000;
        proxy_pass $api_upstream$request_uri;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /api/ {
        set $api_upstream http://hedenagold-api:3000;
        proxy_pass $api_upstream$request_uri;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Product images and other uploads are served by the API (main.ts
    # useStaticAssets at /uploads/), not by this nginx. Without this proxy the
    # ProductImage.url values the UI renders would 404.
    location ^~ /uploads/ {
        set $api_upstream http://hedenagold-api:3000;
        proxy_pass $api_upstream$request_uri;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # The files that say which release is live are never cached: index.html
    # (it names the hashed bundles), sw.js (a stale service worker keeps serving
    # the old precache) and version.json (the update gate polls it). They used
    # to fall under the 6-month rule below, which could pin a browser to an old
    # release. Exact matches win over that regex.
    location = /index.html {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        try_files $uri =404;
    }
    location = /sw.js {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        try_files $uri =404;
    }
    location = /version.json {
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        try_files $uri =404;
    }
    location = /manifest.webmanifest {
        add_header Cache-Control "no-cache" always;
        try_files $uri =404;
    }

    location / {
        try_files $uri $uri/ /index.html;
    }

    location ~* \.(?:ico|css|js|gif|jpe?g|png|woff2?|eot|ttf|svg)$ {
        expires 6M;
        access_log off;
        add_header Cache-Control "public";
    }
}